crio.conf

title: crio.conf(5)

text:
# crio.conf(5)

## NAME
crio.conf - configuration file of the CRI-O OCI Kubernetes Container Runtime daemon

## DESCRIPTION
The CRI-O configuration file specifies all of the available configuration options and command-line flags for the crio(8) OCI Kubernetes Container Runtime daemon ⟨./crio.8.md⟩, but in a TOML format that can be more easily modified and versioned.

CRI-O supports partial configuration reload during runtime, which can be done by sending SIGHUP to the running process. Currently supported options in crio.conf are explicitly marked with 'This option supports live configuration reload'.

The containers-registries.conf(5) file can be reloaded as well by sending SIGHUP to the crio process.

The default crio.conf is located at /etc/crio/crio.conf.

## FORMAT
The TOML format ⟨https://github.com/toml-lang/toml⟩ is used as the encoding of the configuration file. Every option and subtable listed here is nested under a global "crio" table. No bare options are used. The format of TOML can be simplified to:

```
[table]
option = value
[table.subtable1]
option = value
[table.subtable2]
option = value
```

## CRIO TABLE
CRI-O reads its storage defaults from the containers-storage.conf(5) file located at /etc/containers/storage.conf. Modify this storage configuration if you want to change the system's defaults. If you want to modify storage just for CRI-O, you can change the storage configuration options here.

root="/var/lib/containers/storage"

Path to the "root directory". CRI-O stores all of its data, including containers images, in this directory.

runroot="/var/run/containers/storage"

Path to the "run directory". CRI-O stores all of its state in this directory.

storage_driver="overlay"

Storage driver used to manage the storage of images and containers. Please refer to containers-storage.conf(5) to see all available storage drivers.

storage_option=[]

List to pass options to the storage driver. Please refer to containers-storage.conf(5) to see all available storage options.

log_dir="/var/log/crio/pods"

The default log directory where all logs will go unless directly specified by the kubelet. The log directory specified must be an absolute directory.

version_file="/var/run/crio/version"

Location for CRI-O to lay down the temporary version file.

It is used to check if crio wipe should wipe containers, which should

always happen on a node reboot

version_file_persist=""

Location for CRI-O to lay down the persistent version file.

It is used to check if crio wipe should wipe images, which should

only happen when CRI-O has been upgraded

internal_wipe=true

This option is currently DEPRECATED, and will be removed in the future.

Whether CRI-O should wipe containers after a reboot and images after an upgrade when the server starts.

If set to false, one must run crio wipe to wipe the containers and images in these situations.

clean_shutdown_file="/var/lib/crio/clean.shutdown"

Location for CRI-O to lay down the clean shutdown file.

It is used to check whether crio had time to sync before shutting down.

If not found, crio wipe will clear the storage directory.

## CRIO.API TABLE
The crio.api table contains settings for the kubelet/gRPC interface.

listen="/var/run/crio/crio.sock"

Path to AF_LOCAL socket on which CRI-O will listen.

stream_address="127.0.0.1"

IP address on which the stream server will listen.

stream_port="0"

The port on which the stream server will listen. If the port is set to "0", then CRI-O will allocate a random free port number.

stream_enable_tls=false

Enable encrypted TLS transport of the stream server.

stream_idle_timeout=""

Length of time until open streams terminate due to lack of activity.

stream_tls_cert=""

Path to the x509 certificate file used to serve the encrypted stream. This file can change and CRI-O will automatically pick up the changes within 5 minutes.

stream_tls_key=""

Path to the key file used to serve the encrypted stream. This file can change and CRI-O will automatically pick up the changes within 5 minutes.

stream_tls_ca=""

Path to the x509 CA(s) file used to verify and authenticate client communication with the encrypted stream. This file can change and CRI-O will automatically pick up the changes within 5 minutes.

grpc_max_send_msg_size=83886080

Maximum grpc send message size in bytes. If not set or <=0, then CRI-O will default to 80 * 1024 * 1024.

grpc_max_recv_msg_size=83886080

Maximum grpc receive message size. If not set or <= 0, then CRI-O will default to 80 * 1024 * 1024.

## CRIO.RUNTIME TABLE
The crio.runtime table contains settings pertaining to the OCI runtime used and options for how to set up and manage the OCI runtime.

default_runtime="runc"

The name of the OCI runtime to be used as the default. This option supports live configuration reload.

default_ulimits=[]

A list of ulimits to be set in containers by default, specified as "<ulimit name>=<soft limit>:<hard limit>", for example:"nofile=1024:2048". If nothing is set here, settings will be inherited from the CRI-O daemon.

no_pivot=false

If true, the runtime will not use pivot_root, but instead use MS_MOVE.

decryption_keys_path="/etc/crio/keys/"

Path where the keys required for image decryption are located

conmon=""

Path to the conmon binary, used for monitoring the OCI runtime. Will be searched for using $PATH if empty.

This option is currently deprecated, and will be replaced with RuntimeHandler.MonitorPath.

conmon_cgroup=""

Cgroup setting for conmon

This option is currently deprecated, and will be replaced with RuntimeHandler.MonitorCgroup.

conmon_env=[]

Environment variable list for the conmon process, used for passing necessary environment variables to conmon or the runtime.

This option is currently deprecated, and will be replaced with RuntimeHandler.MonitorEnv.

default_env=[]

Additional environment variables to set for all the containers. These are overridden if set in the container image spec or in the container runtime configuration.

selinux=false

If true, SELinux will be used for pod separation on the host.

seccomp_profile=""

Path to the seccomp.json profile which is used as the default seccomp profile for the runtime. If not specified, then the internal default seccomp profile will be used.

seccomp_use_default_when_empty=true

Changes the meaning of an empty seccomp profile. By default (and according to CRI spec), an empty profile means unconfined.

This option tells CRI-O to treat an empty profile as the default profile, which might increase security.

apparmor_profile=""

Used to change the name of the default AppArmor profile of CRI-O. The default profile name is "crio-default".

blockio_config_file=""

Path to the blockio class configuration file for configuring the cgroup blockio controller.

cdi_spec_dirs=[]

Directories to scan for Container Device Interface Specifications to enable CDI device injection. For more details about CDI and the syntax of CDI Spec files please refer to ⟨https://github.com/container-orchestrated-devices/container-device-interface⟩.

Directories later in the list have precedence over earlier ones. The default directory list is:

```
  cdi_spec_dirs = [
	  "/etc/cdi",
	  "/var/run/cdi",

  ]
```

irqbalance_config_file="/etc/sysconfig/irqbalance"

Used to change irqbalance service config file which is used by CRI-O.

For CentOS/SUSE, this file is located at /etc/sysconfig/irqbalance. For Ubuntu, this file is located at /etc/default/irqbalance.

rdt_config_file=""

Path to the RDT configuration file for configuring the resctrl pseudo-filesystem.

cgroup_manager="systemd"

Cgroup management implementation used for the runtime.

default_capabilities=[]

List of default capabilities for containers. If it is empty or commented out, only the capabilities defined in the container json file by the user/kube will be added.

The default list is:

```
  default_capabilities = [
	  "CHOWN",
	  "DAC_OVERRIDE",
	  "FSETID",
	  "FOWNER",
	  "SETGID",
	  "SETUID",
	  "SETPCAP",
	  "NET_BIND_SERVICE",
	  "KILL",

  ]
```

add_inheritable_capabilities=false

Add capabilities to the inheritable set, as well as the default group of permitted, bounding and effective.

If capabilities are expected to work for non-root users, this option should be set.

default_sysctls=[]

List of default sysctls. If it is empty or commented out, only the sysctls defined in the container json file by the user/kube will be added.

One example would be allowing ping inside of containers. On systems that support /proc/sys/net/ipv4/ping_group_range, the default list could be:

```
  default_sysctls = [

       "net.ipv4.ping_group_range = 0   2147483647",

  ]
```

allowed_devices=[]

List of devices on the host that a user can specify with the "io.kubernetes.cri-o.Devices" allowed annotation.

additional_devices=[]

List of additional devices. Specified as "<device-on-host>:<device-on-container>:<permissions>", for example: "--additional-devices=/dev/sdc:/dev/xvdc:rwm". If it is empty or commented out, only the devices defined in the container json file by the user/kube will be added.

hooks_dir=["path", ...]

Each *.json file in the path configures a hook for CRI-O containers. For more details on the syntax of the JSON files and the semantics of hook injection, see oci-hooks(5). CRI-O currently support both the 1.0.0 and 0.1.0 hook schemas, although the 0.1.0 schema is deprecated.

Paths listed later in the array have higher precedence (oci-hooks(5) discusses directory precedence).

For the annotation conditions, CRI-O uses the Kubernetes annotations, which are a subset of the annotations passed to the OCI runtime. For example, io.kubernetes.cri-o.Volumes is part of the OCI runtime configuration annotations, but it is not part of the Kubernetes annotations being matched for hooks.

For the bind-mount conditions, only mounts explicitly requested by Kubernetes configuration are considered. Bind mounts that CRI-O inserts by default (e.g. /dev/shm) are not considered.

default_mounts=[]

List of default mounts for each container. Deprecated: this option will be removed in future versions in favor of default_mounts_file.

default_mounts_file=""

Path to the file specifying the defaults mounts for each container. The format of the config is /SRC:/DST, one mount per line. Notice that CRI-O reads its default mounts from the following two files:

```
1) `/etc/containers/mounts.conf` (i.e., default_mounts_file): This is the override file, where users can either add in their own default mounts, or override the default mounts shipped with the package.
2) `/usr/share/containers/mounts.conf`: This is the default file read for mounts. If you want CRI-O to read from a different, specific mounts file, you can change the default_mounts_file. Note, if this is done, CRI-O will only add mounts it finds in this file.
```

pids_limit=0

Maximum number of processes allowed in a container.

This option is deprecated. The Kubelet flag --pod-pids-limit should be used instead.

log_filter=""

Filter the log messages by the provided regular expression. This option supports live configuration reload. For example 'request:.*' filters all gRPC requests.

log_level="info"

Changes the verbosity of the logs based on the level it is set to. Options are fatal, panic, error, warn, info, debug, and trace. This option supports live configuration reload.

log_size_max=-1

Maximum size allowed for the container log file. Negative numbers indicate that no size limit is imposed. If it is positive, it must be >= 8192 to match/exceed conmon's read buffer. The file is truncated and re-opened so the limit is never exceeded.

This option is deprecated. The Kubelet flag --container-log-max-size should be used instead.

log_to_journald=false

Whether container output should be logged to journald in addition to the kuberentes log file.

container_exits_dir="/var/run/crio/exits"

Path to directory in which container exit files are written to by conmon.

container_attach_socket_dir="/var/run/crio"

Path to directory for container attach sockets.

bind_mount_prefix=""

A prefix to use for the source of the bind mounts. This option would be useful when running CRI-O in a container and the / directory on the host is mounted as /host in the container. Then if CRI-O runs with the --bind-mount-prefix=/host option, CRI-O would add the /host directory to any bind mounts it hands over to CRI. If Kubernetes asked to have /var/lib/foobar bind mounted into the container, then CRI-O would bind mount /host/var/lib/foobar. Since CRI-O itself is running in a container with / or the host mounted on /host, the container would end up with /var/lib/foobar from the host mounted in the container rather than /var/lib/foobar from the CRI-O container.

read_only=false

If set to true, all containers will run in read-only mode.

uid_mappings=""

The UID mappings for the user namespace of each container. A range is specified in the form containerUID:HostUID:Size. Multiple ranges must be separated by comma.

minimum_mappable_uid=-1

The lowest host UID which can be specified in mappings supplied, either as part of a uid_mappings or as part of a request received over CRI, for a pod that will be run as a UID other than 0.

gid_mappings=""

The GID mappings for the user namespace of each container. A range is specified in the form containerGID:HostGID:Size. Multiple ranges must be separated by comma.

minimum_mappable_gid=-1

The lowest host GID which can be specified in mappings supplied, either as part of a gid_mappings or as part of a request received over CRI, for a pod that will be run as a UID other than 0.

ctr_stop_timeout=30

The minimal amount of time in seconds to wait before issuing a timeout regarding the proper termination of the container.

drop_infra_ctr=true

Determines whether we drop the infra container when a pod does not have a private PID namespace, and does not use a kernel separating runtime (like kata).

Requies manage_ns_lifecycle to be true.

infra_ctr_cpuset=""

Determines the CPU set to run infra containers. If not specified, the CRI-O will use all online CPUs to run infra containers.

You can specify CPUs in the Linux CPU list format.

To get better isolation for guaranteed pods, set this parameter to be equal to kubelet reserved-cpus.

namespaces_dir="/var/run"

The directory where the state of the managed namespaces gets tracked. Only used when manage_ns_lifecycle is true

pinns_path=""

The path to find the pinns binary, which is needed to manage namespace lifecycle

absent_mount_sources_to_reject=[]

A list of paths that, when absent from the host, will cause a container creation to fail (as opposed to the current behavior of creating a directory).

device_ownership_from_security_context=false

Changes the default behavior of setting container devices uid/gid from CRI's SecurityContext (RunAsUser/RunAsGroup) instead of taking host's uid/gid.

enable_criu_support=false

Enable CRIU integration, requires that the criu binary is available in $PATH. (default: false)

enable_pod_events=false Enable CRI-O to generate the container pod-level events in order to optimize the performance of the Pod Lifecycle Event Generator (PLEG) module in Kubelet.

### CRIO.RUNTIME.RUNTIMES TABLE
The "crio.runtime.runtimes" table defines a list of OCI compatible runtimes. The runtime to use is picked based on the runtime handler provided by the CRI. If no runtime handler is provided, the runtime will be picked based on the level of trust of the workload. This option supports live configuration reload. This option supports live configuration reload.

runtime_path=""

Path to the OCI compatible runtime used for this runtime handler.

runtime_root=""

Root directory used to store runtime data

runtime_type="oci"

Type of the runtime used for this runtime handler. "oci", "vm"

runtime_config_path=""

Path to the runtime configuration file, should only be used with VM runtime types

privileged_without_host_devices=false

Whether this runtime handler prevents host devices from being passed to privileged containers.

allowed_annotations=[]

This field is currently DEPRECATED. If you'd like to use allowed_annotations, please use a workload.

A list of experimental annotations this runtime handler is allowed to process.

The currently recognized values are:

"io.kubernetes.cri-o.userns-mode" for configuring a user namespace for the pod.

"io.kubernetes.cri-o.Devices" for configuring devices for the pod.

"io.kubernetes.cri-o.ShmSize" for configuring the size of /dev/shm.

"io.kubernetes.cri-o.UnifiedCgroup.$CTR_NAME" for configuring the cgroup v2 unified block for a container.

"io.containers.trace-syscall" for tracing syscalls via the OCI seccomp BPF hook.

### CRIO.RUNTIME.WORKLOADS TABLE
The "crio.runtime.workloads" table defines a list of workloads - a way to customize the behavior of a pod and container. A workload is chosen for a pod based on whether the workload's activation_annotation is an annotation on the pod.

activation_annotation=""

activation_annotation is the pod annotation that activates these workload settings.

annotation_prefix=""

annotation_prefix is the way a pod can override a specific resource for a container.

The full annotation must be of the form $annotation_prefix.$resource/$ctrname = $value.

allowed_annotations=[]

allowed_annotations is a slice of experimental annotations that this workload is allowed to process.

The currently recognized values are:

"io.kubernetes.cri-o.userns-mode" for configuring a user namespace for the pod.

"io.kubernetes.cri-o.Devices" for configuring devices for the pod.

"io.kubernetes.cri-o.ShmSize" for configuring the size of /dev/shm.

"io.kubernetes.cri-o.UnifiedCgroup.$CTR_NAME" for configuring the cgroup v2 unified block for a container.

"io.containers.trace-syscall" for tracing syscalls via the OCI seccomp BPF hook.

"io.kubernetes.cri-o.seccompNotifierAction" for enabling the seccomp notifier feature.

### Using the seccomp notifier feature:
This feature can help you to debug seccomp related issues, for example if blocked syscalls (permission denied errors) have negative impact on the workload.

To be able to use this feature, configure a runtime which has the annotation "io.kubernetes.cri-o.seccompNotifierAction" in the allowed_annotations array.

It also requires at least runc 1.1.0 or crun 0.19 which support the notifier feature.

If everything is setup, CRI-O will modify chosen seccomp profiles for containers if the annotation "io.kubernetes.cri-o.seccompNotifierAction" is set on the Pod sandbox. CRI-O will then get notified if a container is using a blocked syscall and then terminate the workload after a timeout of 5 seconds if the value of "io.kubernetes.cri-o.seccompNotifierAction=stop".

This also means that multiple syscalls can be captured during that period, while the timeout will get reset once a new syscall has been discovered.

This also means that the Pods "restartPolicy" has to be set to "Never", otherwise the kubelet will restart the container immediately.

Please be aware that CRI-O is not able to get notified if a syscall gets blocked based on the seccomp defaultAction, which is a general runtime limitation.

### CRIO.RUNTIME.WORKLOAD.RESOURCES TABLE
The resources table is a structure for overriding certain resources for pods using this workload. This structure provides a default value, and can be overridden by using the AnnotationPrefix.

cpushares="" Specifies the number of CPU shares this pod has access to.

cpuset="" Specifies the cpuset this pod has access to.

## CRIO.IMAGE TABLE
The crio.image table contains settings pertaining to the management of OCI images.

CRI-O reads its configured registries defaults from the system wide containers-registries.conf(5) located in /etc/containers/registries.conf. If you want to modify just CRI-O, you can change the registries configuration in this file. Otherwise, leave insecure_registries and registries commented out to use the system's defaults from /etc/containers/registries.conf.

default_transport="docker://"

Default transport for pulling images from a remote container storage.

global_auth_file=""

The path to a file like /var/lib/kubelet/config.json holding credentials necessary for pulling images from secure registries.

pause_image="registry.k8s.io/pause:3.6"

The image used to instantiate infra containers. This option supports live configuration reload.

pause_image_auth_file=""

The path to a file like /var/lib/kubelet/config.json holding credentials specific to pulling the pause_image from above. This option supports live configuration reload.

pause_command="/pause"

The command to run to have a container stay in the paused state. This option supports live configuration reload.

signature_policy=""

Path to the file which decides what sort of policy we use when deciding whether or not to trust an image that we've pulled. It is not recommended that this option be used, as the default behavior of using the system-wide default policy (i.e., /etc/containers/policy.json) is most often preferred. Please refer to containers-policy.json(5) for more details.

image_volumes="mkdir"

Controls how image volumes are handled. The valid values are mkdir, bind and ignore; the latter will ignore volumes entirely.

insecure_registries=[]

List of registries to skip TLS verification for pulling images.

registries=["docker.io"]

List of registries to be used when pulling an unqualified image. Note support for this option has been dropped and it has no effect. Please refer to containers-registries.conf(5) for configuring unqualified-search registries.

big_files_temporary_dir=""

Path to the temporary directory to use for storing big files, used to store image blobs and data streams related to containers image management.

separate_pull_cgroup=""

[EXPERIMENTAL] If its value is set, then images are pulled into the specified cgroup. If its value is set to "pod", then the pod's cgroup is used. It is currently supported only with the systemd cgroup manager.

## CRIO.NETWORK TABLE
The crio.network table containers settings pertaining to the management of CNI plugins.

cni_default_network=""

The default CNI network name to be selected. If not set or "", then CRI-O will pick-up the first one found in network_dir.

network_dir="/etc/cni/net.d/"

Path to the directory where CNI configuration files are located.

plugin_dirs=["/opt/cni/bin/",]

List of paths to directories where CNI plugin binaries are located.

## CRIO.METRICS TABLE
The crio.metrics table containers settings pertaining to the Prometheus based metrics retrieval.

enable_metrics=false

Globally enable or disable metrics support.

metrics_collectors=["operations", "operations_latency_microseconds_total", "operations_latency_microseconds", "operations_errors", "image_pulls_by_digest", "image_pulls_by_name", "image_pulls_by_name_skipped", "image_pulls_failures", "image_pulls_successes", "image_pulls_layer_size", "image_layer_reuse", "containers_oom_total", "containers_oom", "processes_defunct"]

Enabled metrics collectors

metrics_port=9090

The port on which the metrics server will listen.

metrics_socket=""

The socket on which the metrics server will listen.

metrics_cert=""

The certificate for the secure metrics server.

metrics_key=""

The certificate key for the secure metrics server.

## CRIO.TRACING TABLE
[EXPERIMENTAL] The crio.tracing table containers settings pertaining to the export of OpenTelemetry trace data.

enable_tracing=false

Globally enable or disable OpenTelemetry trace data exporting.

tracing_endpoint="0.0.0.0:4317"

Address on which the gRPC trace collector will listen.

tracing_sampling_rate_per_million=""

Number of samples to collect per million OpenTelemetry spans. Set to 1000000 to always sample.

## CRIO.STATS TABLE
The crio.stats table specifies all necessary configuration for reporting container and pod stats.

stats_collection_period=0

The number of seconds between collecting pod and container stats. If set to 0, the stats are collected on-demand instead.

## CRIO.NRI TABLE
The crio.nri table contains settings for controlling NRI (Node Resource Interface) support in CRI-O. enable_nri=false

Enable CRI-O NRI support.

nri_plugin_dir="/opt/nri/plugins"

Directory to scan for pre-installed plugins to automatically start.

nri_plugin_config_dir="/etc/nri/conf.d"

Directory to scan for configuration of pre-installed plugins.

nri_listen="/var/run/nri/nri.sock"

Socket to listen on for externally started NRI plugins to connect to.

nri_disable_connections=false

Disable connections from externally started NRI plugins.

nri_plugin_registration_timeout="5s"

Timeout for a plugin to register itself with NRI.

nri_plugin_request_timeout="2s"

Timeout for a plugin to handle an NRI request.

## SEE ALSO
crio.conf.d(5), containers-storage.conf(5), containers-policy.json(5), containers-registries.conf(5), crio(8)

## HISTORY
Aug 2018, Update to the latest state by Valentin Rothberg ⟨vrothberg@suse.com⟩

Oct 2016, Originally compiled by Aleksa Sarai ⟨asarai@suse.de⟩


crio.conf.d

title: crio.conf.d(5)

summary: directory for drop\-in configuration files for CRI\-O

text:
# crio.conf.d(5)

## NAME
crio.conf.d - directory for drop-in configuration files for CRI-O

## DESCRIPTION
Additionally to configuration in crio.conf(5), CRI-O allows to drop configuration snippets into the crio.conf.d directory. The default directory is /etc/crio/crio.conf.d/. The path can be changed via CRIO's --config-dir command line option.

## CONFIGURATION PRECEDENCE
When it exists, the main configuration file (/etc/crio/crio.conf by default) is read before any file in the configuration directory (/etc/crio/crio.conf.d). Settings in that file have the lowest precedence.

Files in the configuration directory are sorted by name in lexical order and applied in that order. If multiple configuration files specify the same configuration option the setting specified in file sorted last takes precedence over any other value. That is if both 00-default.conf and 10-custom.conf exist in crio.conf.d and both specify different values for a certain configuration option the value from 10-custom.conf will be applied.

## SEE ALSO
crio.conf(5), crio(8)


crio.conf

title: crio.conf(5)

summary: configuration file of the CRI\-O OCI Kubernetes Container Runtime daemon

text:
# crio.conf(5)

## NAME
crio.conf - configuration file of the CRI-O OCI Kubernetes Container Runtime daemon

## DESCRIPTION
The CRI-O configuration file specifies all of the available configuration options and command-line flags for the crio(8) OCI Kubernetes Container Runtime daemon ⟨./crio.8.md⟩, but in a TOML format that can be more easily modified and versioned.

CRI-O supports partial configuration reload during runtime, which can be done by sending SIGHUP to the running process. Currently supported options in crio.conf are explicitly marked with 'This option supports live configuration reload'.

The containers-registries.conf(5) file can be reloaded as well by sending SIGHUP to the crio process.

The default crio.conf is located at /etc/crio/crio.conf.

## FORMAT
The TOML format ⟨https://github.com/toml-lang/toml⟩ is used as the encoding of the configuration file. Every option and subtable listed here is nested under a global "crio" table. No bare options are used. The format of TOML can be simplified to:

```
[table]
option = value
[table.subtable1]
option = value
[table.subtable2]
option = value
```

## CRIO TABLE
CRI-O reads its storage defaults from the containers-storage.conf(5) file located at /etc/containers/storage.conf. Modify this storage configuration if you want to change the system's defaults. If you want to modify storage just for CRI-O, you can change the storage configuration options here.

root="/var/lib/containers/storage"

Path to the "root directory". CRI-O stores all of its data, including containers images, in this directory.

runroot="/var/run/containers/storage"

Path to the "run directory". CRI-O stores all of its state in this directory.

storage_driver="overlay"

Storage driver used to manage the storage of images and containers. Please refer to containers-storage.conf(5) to see all available storage drivers.

storage_option=[]

List to pass options to the storage driver. Please refer to containers-storage.conf(5) to see all available storage options.

log_dir="/var/log/crio/pods"

The default log directory where all logs will go unless directly specified by the kubelet. The log directory specified must be an absolute directory.

version_file="/var/run/crio/version"

Location for CRI-O to lay down the temporary version file.

It is used to check if crio wipe should wipe containers, which should

always happen on a node reboot

version_file_persist=""

Location for CRI-O to lay down the persistent version file.

It is used to check if crio wipe should wipe images, which should

only happen when CRI-O has been upgraded

internal_wipe=true

This option is currently DEPRECATED, and will be removed in the future.

Whether CRI-O should wipe containers after a reboot and images after an upgrade when the server starts.

If set to false, one must run crio wipe to wipe the containers and images in these situations.

clean_shutdown_file="/var/lib/crio/clean.shutdown"

Location for CRI-O to lay down the clean shutdown file.

It is used to check whether crio had time to sync before shutting down.

If not found, crio wipe will clear the storage directory.

## CRIO.API TABLE
The crio.api table contains settings for the kubelet/gRPC interface.

listen="/var/run/crio/crio.sock"

Path to AF_LOCAL socket on which CRI-O will listen.

stream_address="127.0.0.1"

IP address on which the stream server will listen.

stream_port="0"

The port on which the stream server will listen. If the port is set to "0", then CRI-O will allocate a random free port number.

stream_enable_tls=false

Enable encrypted TLS transport of the stream server.

stream_idle_timeout=""

Length of time until open streams terminate due to lack of activity.

stream_tls_cert=""

Path to the x509 certificate file used to serve the encrypted stream. This file can change and CRI-O will automatically pick up the changes within 5 minutes.

stream_tls_key=""

Path to the key file used to serve the encrypted stream. This file can change and CRI-O will automatically pick up the changes within 5 minutes.

stream_tls_ca=""

Path to the x509 CA(s) file used to verify and authenticate client communication with the encrypted stream. This file can change and CRI-O will automatically pick up the changes within 5 minutes.

grpc_max_send_msg_size=83886080

Maximum grpc send message size in bytes. If not set or <=0, then CRI-O will default to 80 * 1024 * 1024.

grpc_max_recv_msg_size=83886080

Maximum grpc receive message size. If not set or <= 0, then CRI-O will default to 80 * 1024 * 1024.

## CRIO.RUNTIME TABLE
The crio.runtime table contains settings pertaining to the OCI runtime used and options for how to set up and manage the OCI runtime.

default_runtime="runc"

The name of the OCI runtime to be used as the default. This option supports live configuration reload.

default_ulimits=[]

A list of ulimits to be set in containers by default, specified as "<ulimit name>=<soft limit>:<hard limit>", for example:"nofile=1024:2048". If nothing is set here, settings will be inherited from the CRI-O daemon.

no_pivot=false

If true, the runtime will not use pivot_root, but instead use MS_MOVE.

decryption_keys_path="/etc/crio/keys/"

Path where the keys required for image decryption are located

conmon=""

Path to the conmon binary, used for monitoring the OCI runtime. Will be searched for using $PATH if empty.

This option is currently deprecated, and will be replaced with RuntimeHandler.MonitorPath.

conmon_cgroup=""

Cgroup setting for conmon

This option is currently deprecated, and will be replaced with RuntimeHandler.MonitorCgroup.

conmon_env=[]

Environment variable list for the conmon process, used for passing necessary environment variables to conmon or the runtime.

This option is currently deprecated, and will be replaced with RuntimeHandler.MonitorEnv.

default_env=[]

Additional environment variables to set for all the containers. These are overridden if set in the container image spec or in the container runtime configuration.

selinux=false

If true, SELinux will be used for pod separation on the host.

seccomp_profile=""

Path to the seccomp.json profile which is used as the default seccomp profile for the runtime. If not specified, then the internal default seccomp profile will be used.

This option is currently deprecated, and will be replaced by the SeccompDefault FeatureGate in Kubernetes.

seccomp_use_default_when_empty=true

Changes the meaning of an empty seccomp profile. By default (and according to CRI spec), an empty profile means unconfined.

This option tells CRI-O to treat an empty profile as the default profile, which might increase security.

apparmor_profile=""

Used to change the name of the default AppArmor profile of CRI-O. The default profile name is "crio-default".

blockio_config_file=""

Path to the blockio class configuration file for configuring the cgroup blockio controller.

cdi_spec_dirs=[]

Directories to scan for Container Device Interface Specifications to enable CDI device injection. For more details about CDI and the syntax of CDI Spec files please refer to ⟨https://github.com/container-orchestrated-devices/container-device-interface⟩.

Directories later in the list have precedence over earlier ones. The default directory list is:

```
  cdi_spec_dirs = [
	  "/etc/cdi",
	  "/var/run/cdi",

  ]
```

irqbalance_config_file="/etc/sysconfig/irqbalance"

Used to change irqbalance service config file which is used by CRI-O.

For CentOS/SUSE, this file is located at /etc/sysconfig/irqbalance. For Ubuntu, this file is located at /etc/default/irqbalance.

irqbalance_config_restore_file="/etc/sysconfig/orig_irq_banned_cpus"

Used to set the irqbalance banned cpu mask to restore at CRI-O startup. If set to 'disable', no restoration attempt will be done.

rdt_config_file=""

Path to the RDT configuration file for configuring the resctrl pseudo-filesystem.

cgroup_manager="systemd"

Cgroup management implementation used for the runtime.

default_capabilities=[]

List of default capabilities for containers. If it is empty or commented out, only the capabilities defined in the container json file by the user/kube will be added.

The default list is:

```
  default_capabilities = [
	  "CHOWN",
	  "DAC_OVERRIDE",
	  "FSETID",
	  "FOWNER",
	  "SETGID",
	  "SETUID",
	  "SETPCAP",
	  "NET_BIND_SERVICE",
	  "KILL",

  ]
```

add_inheritable_capabilities=false

Add capabilities to the inheritable set, as well as the default group of permitted, bounding and effective.

If capabilities are expected to work for non-root users, this option should be set.

default_sysctls=[]

List of default sysctls. If it is empty or commented out, only the sysctls defined in the container json file by the user/kube will be added.

One example would be allowing ping inside of containers. On systems that support /proc/sys/net/ipv4/ping_group_range, the default list could be:

```
  default_sysctls = [

       "net.ipv4.ping_group_range = 0   2147483647",

  ]
```

allowed_devices=[]

List of devices on the host that a user can specify with the "io.kubernetes.cri-o.Devices" allowed annotation.

additional_devices=[]

List of additional devices. Specified as "<device-on-host>:<device-on-container>:<permissions>", for example: "--additional-devices=/dev/sdc:/dev/xvdc:rwm". If it is empty or commented out, only the devices defined in the container json file by the user/kube will be added.

hooks_dir=["path", ...]

Each *.json file in the path configures a hook for CRI-O containers. For more details on the syntax of the JSON files and the semantics of hook injection, see oci-hooks(5). CRI-O currently support both the 1.0.0 and 0.1.0 hook schemas, although the 0.1.0 schema is deprecated.

Paths listed later in the array have higher precedence (oci-hooks(5) discusses directory precedence).

For the annotation conditions, CRI-O uses the Kubernetes annotations, which are a subset of the annotations passed to the OCI runtime. For example, io.kubernetes.cri-o.Volumes is part of the OCI runtime configuration annotations, but it is not part of the Kubernetes annotations being matched for hooks.

For the bind-mount conditions, only mounts explicitly requested by Kubernetes configuration are considered. Bind mounts that CRI-O inserts by default (e.g. /dev/shm) are not considered.

default_mounts=[]

List of default mounts for each container. Deprecated: this option will be removed in future versions in favor of default_mounts_file.

default_mounts_file=""

Path to the file specifying the defaults mounts for each container. The format of the config is /SRC:/DST, one mount per line. Notice that CRI-O reads its default mounts from the following two files:

```
1) `/etc/containers/mounts.conf` (i.e., default_mounts_file): This is the override file, where users can either add in their own default mounts, or override the default mounts shipped with the package.
2) `/usr/share/containers/mounts.conf`: This is the default file read for mounts. If you want CRI-O to read from a different, specific mounts file, you can change the default_mounts_file. Note, if this is done, CRI-O will only add mounts it finds in this file.
```

pids_limit=0

Maximum number of processes allowed in a container.

This option is deprecated. The Kubelet flag --pod-pids-limit should be used instead.

log_filter=""

Filter the log messages by the provided regular expression. This option supports live configuration reload. For example 'request:.*' filters all gRPC requests.

log_level="info"

Changes the verbosity of the logs based on the level it is set to. Options are fatal, panic, error, warn, info, debug, and trace. This option supports live configuration reload.

log_size_max=-1

Maximum size allowed for the container log file. Negative numbers indicate that no size limit is imposed. If it is positive, it must be >= 8192 to match/exceed conmon's read buffer. The file is truncated and re-opened so the limit is never exceeded.

This option is deprecated. The Kubelet flag --container-log-max-size should be used instead.

log_to_journald=false

Whether container output should be logged to journald in addition to the kuberentes log file.

container_exits_dir="/var/run/crio/exits"

Path to directory in which container exit files are written to by conmon.

container_attach_socket_dir="/var/run/crio"

Path to directory for container attach sockets.

bind_mount_prefix=""

A prefix to use for the source of the bind mounts. This option would be useful when running CRI-O in a container and the / directory on the host is mounted as /host in the container. Then if CRI-O runs with the --bind-mount-prefix=/host option, CRI-O would add the /host directory to any bind mounts it hands over to CRI. If Kubernetes asked to have /var/lib/foobar bind mounted into the container, then CRI-O would bind mount /host/var/lib/foobar. Since CRI-O itself is running in a container with / or the host mounted on /host, the container would end up with /var/lib/foobar from the host mounted in the container rather than /var/lib/foobar from the CRI-O container.

read_only=false

If set to true, all containers will run in read-only mode.

uid_mappings=""

The UID mappings for the user namespace of each container. A range is specified in the form containerUID:HostUID:Size. Multiple ranges must be separated by comma.

minimum_mappable_uid=-1

The lowest host UID which can be specified in mappings supplied, either as part of a uid_mappings or as part of a request received over CRI, for a pod that will be run as a UID other than 0.

gid_mappings=""

The GID mappings for the user namespace of each container. A range is specified in the form containerGID:HostGID:Size. Multiple ranges must be separated by comma.

minimum_mappable_gid=-1

The lowest host GID which can be specified in mappings supplied, either as part of a gid_mappings or as part of a request received over CRI, for a pod that will be run as a UID other than 0.

ctr_stop_timeout=30

The minimal amount of time in seconds to wait before issuing a timeout regarding the proper termination of the container.

drop_infra_ctr=true

Determines whether we drop the infra container when a pod does not have a private PID namespace, and does not use a kernel separating runtime (like kata).

Requies manage_ns_lifecycle to be true.

infra_ctr_cpuset=""

Determines the CPU set to run infra containers. If not specified, the CRI-O will use all online CPUs to run infra containers.

You can specify CPUs in the Linux CPU list format.

To get better isolation for guaranteed pods, set this parameter to be equal to kubelet reserved-cpus.

namespaces_dir="/var/run"

The directory where the state of the managed namespaces gets tracked. Only used when manage_ns_lifecycle is true

pinns_path=""

The path to find the pinns binary, which is needed to manage namespace lifecycle

absent_mount_sources_to_reject=[]

A list of paths that, when absent from the host, will cause a container creation to fail (as opposed to the current behavior of creating a directory).

device_ownership_from_security_context=false

Changes the default behavior of setting container devices uid/gid from CRI's SecurityContext (RunAsUser/RunAsGroup) instead of taking host's uid/gid.

enable_criu_support=false

Enable CRIU integration, requires that the criu binary is available in $PATH. (default: false)

enable_pod_events=false Enable CRI-O to generate the container pod-level events in order to optimize the performance of the Pod Lifecycle Event Generator (PLEG) module in Kubelet.

hostnetwork_disable_selinux=true

Determines whether SELinux should be disabled within a pod when it is running in the host network namespace.

### CRIO.RUNTIME.RUNTIMES TABLE
The "crio.runtime.runtimes" table defines a list of OCI compatible runtimes. The runtime to use is picked based on the runtime handler provided by the CRI. If no runtime handler is provided, the runtime will be picked based on the level of trust of the workload. This option supports live configuration reload. This option supports live configuration reload.

runtime_path=""

Path to the OCI compatible runtime used for this runtime handler.

runtime_root=""

Root directory used to store runtime data

runtime_type="oci"

Type of the runtime used for this runtime handler. "oci", "vm"

runtime_config_path=""

Path to the runtime configuration file, should only be used with VM runtime types

privileged_without_host_devices=false

Whether this runtime handler prevents host devices from being passed to privileged containers.

allowed_annotations=[]

This field is currently DEPRECATED. If you'd like to use allowed_annotations, please use a workload.

A list of experimental annotations this runtime handler is allowed to process.

The currently recognized values are:

"io.kubernetes.cri-o.userns-mode" for configuring a user namespace for the pod.

"io.kubernetes.cri-o.Devices" for configuring devices for the pod.

"io.kubernetes.cri-o.ShmSize" for configuring the size of /dev/shm.

"io.kubernetes.cri-o.UnifiedCgroup.$CTR_NAME" for configuring the cgroup v2 unified block for a container.

"io.containers.trace-syscall" for tracing syscalls via the OCI seccomp BPF hook.

platform_runtime_paths={}

A mapping of platforms to the corresponding runtime executable paths for the runtime handler.

### CRIO.RUNTIME.WORKLOADS TABLE
The "crio.runtime.workloads" table defines a list of workloads - a way to customize the behavior of a pod and container. A workload is chosen for a pod based on whether the workload's activation_annotation is an annotation on the pod.

activation_annotation=""

activation_annotation is the pod annotation that activates these workload settings.

annotation_prefix=""

annotation_prefix is the way a pod can override a specific resource for a container.

The full annotation must be of the form $annotation_prefix.$resource/$ctrname = $value.

allowed_annotations=[]

allowed_annotations is a slice of experimental annotations that this workload is allowed to process.

The currently recognized values are:

"io.kubernetes.cri-o.userns-mode" for configuring a user namespace for the pod.

"io.kubernetes.cri-o.Devices" for configuring devices for the pod.

"io.kubernetes.cri-o.ShmSize" for configuring the size of /dev/shm.

"io.kubernetes.cri-o.UnifiedCgroup.$CTR_NAME" for configuring the cgroup v2 unified block for a container.

"io.containers.trace-syscall" for tracing syscalls via the OCI seccomp BPF hook.

"io.kubernetes.cri-o.seccompNotifierAction" for enabling the seccomp notifier feature.

"io.kubernetes.cri-o.umask" for setting the umask for container init process.

### Using the seccomp notifier feature:
This feature can help you to debug seccomp related issues, for example if blocked syscalls (permission denied errors) have negative impact on the workload.

To be able to use this feature, configure a runtime which has the annotation "io.kubernetes.cri-o.seccompNotifierAction" in the allowed_annotations array.

It also requires at least runc 1.1.0 or crun 0.19 which support the notifier feature.

If everything is setup, CRI-O will modify chosen seccomp profiles for containers if the annotation "io.kubernetes.cri-o.seccompNotifierAction" is set on the Pod sandbox. CRI-O will then get notified if a container is using a blocked syscall and then terminate the workload after a timeout of 5 seconds if the value of "io.kubernetes.cri-o.seccompNotifierAction=stop".

This also means that multiple syscalls can be captured during that period, while the timeout will get reset once a new syscall has been discovered.

This also means that the Pods "restartPolicy" has to be set to "Never", otherwise the kubelet will restart the container immediately.

Please be aware that CRI-O is not able to get notified if a syscall gets blocked based on the seccomp defaultAction, which is a general runtime limitation.

### CRIO.RUNTIME.WORKLOAD.RESOURCES TABLE
The resources table is a structure for overriding certain resources for pods using this workload. This structure provides a default value, and can be overridden by using the AnnotationPrefix.

cpushares="" Specifies the number of CPU shares this pod has access to.

cpuset="" Specifies the cpuset this pod has access to.

## CRIO.IMAGE TABLE
The crio.image table contains settings pertaining to the management of OCI images.

CRI-O reads its configured registries defaults from the system wide containers-registries.conf(5) located in /etc/containers/registries.conf. If you want to modify just CRI-O, you can change the registries configuration in this file. Otherwise, leave insecure_registries and registries commented out to use the system's defaults from /etc/containers/registries.conf.

default_transport="docker://"

Default transport for pulling images from a remote container storage.

global_auth_file=""

The path to a file like /var/lib/kubelet/config.json holding credentials necessary for pulling images from secure registries.

pause_image="registry.k8s.io/pause:3.9"

The image used to instantiate infra containers. This option supports live configuration reload.

pause_image_auth_file=""

The path to a file like /var/lib/kubelet/config.json holding credentials specific to pulling the pause_image from above. This option supports live configuration reload.

pause_command="/pause"

The command to run to have a container stay in the paused state. This option supports live configuration reload.

signature_policy=""

Path to the file which decides what sort of policy we use when deciding whether or not to trust an image that we've pulled. It is not recommended that this option be used, as the default behavior of using the system-wide default policy (i.e., /etc/containers/policy.json) is most often preferred. Please refer to containers-policy.json(5) for more details.

signature_policy_dir="/etc/crio/policies"

Root path for pod namespace-separated signature policies. The final policy to be used on image pull will be <SIGNATURE_POLICY_DIR>/<NAMESPACE>.json. If no pod namespace is being provided on image pull (via the sandbox config), or the concatenated path is non existent, then the signature_policy or system wide policy will be used as fallback. Must be an absolute path.

image_volumes="mkdir"

Controls how image volumes are handled. The valid values are mkdir, bind and ignore; the latter will ignore volumes entirely.

insecure_registries=[]

List of registries to skip TLS verification for pulling images.

registries=["docker.io"]

List of registries to be used when pulling an unqualified image. Note support for this option has been dropped and it has no effect. Please refer to containers-registries.conf(5) for configuring unqualified-search registries.

big_files_temporary_dir=""

Path to the temporary directory to use for storing big files, used to store image blobs and data streams related to containers image management.

separate_pull_cgroup=""

[EXPERIMENTAL] If its value is set, then images are pulled into the specified cgroup. If its value is set to "pod", then the pod's cgroup is used. It is currently supported only with the systemd cgroup manager.

## CRIO.NETWORK TABLE
The crio.network table containers settings pertaining to the management of CNI plugins.

cni_default_network=""

The default CNI network name to be selected. If not set or "", then CRI-O will pick-up the first one found in network_dir.

network_dir="/etc/cni/net.d/"

Path to the directory where CNI configuration files are located.

plugin_dirs=["/opt/cni/bin/",]

List of paths to directories where CNI plugin binaries are located.

## CRIO.METRICS TABLE
The crio.metrics table containers settings pertaining to the Prometheus based metrics retrieval.

enable_metrics=false

Globally enable or disable metrics support.

metrics_collectors=["operations", "operations_latency_microseconds_total", "operations_latency_microseconds", "operations_errors", "image_pulls_by_digest", "image_pulls_by_name", "image_pulls_by_name_skipped", "image_pulls_failures", "image_pulls_successes", "image_pulls_layer_size", "image_layer_reuse", "containers_oom_total", "containers_oom", "processes_defunct"]

Enabled metrics collectors

metrics_port=9090

The port on which the metrics server will listen.

metrics_socket=""

The socket on which the metrics server will listen.

metrics_cert=""

The certificate for the secure metrics server.

metrics_key=""

The certificate key for the secure metrics server.

## CRIO.TRACING TABLE
[EXPERIMENTAL] The crio.tracing table containers settings pertaining to the export of OpenTelemetry trace data.

enable_tracing=false

Globally enable or disable OpenTelemetry trace data exporting.

tracing_endpoint="0.0.0.0:4317"

Address on which the gRPC trace collector will listen.

tracing_sampling_rate_per_million=""

Number of samples to collect per million OpenTelemetry spans. Set to 1000000 to always sample.

## CRIO.STATS TABLE
The crio.stats table specifies all necessary configuration for reporting container and pod stats.

stats_collection_period=0

The number of seconds between collecting pod and container stats. If set to 0, the stats are collected on-demand instead.

## CRIO.NRI TABLE
The crio.nri table contains settings for controlling NRI (Node Resource Interface) support in CRI-O. enable_nri=false

Enable CRI-O NRI support.

nri_plugin_dir="/opt/nri/plugins"

Directory to scan for pre-installed plugins to automatically start.

nri_plugin_config_dir="/etc/nri/conf.d"

Directory to scan for configuration of pre-installed plugins.

nri_listen="/var/run/nri/nri.sock"

Socket to listen on for externally started NRI plugins to connect to.

nri_disable_connections=false

Disable connections from externally started NRI plugins.

nri_plugin_registration_timeout="5s"

Timeout for a plugin to register itself with NRI.

nri_plugin_request_timeout="2s"

Timeout for a plugin to handle an NRI request.

## SEE ALSO
crio.conf.d(5), containers-storage.conf(5), containers-policy.json(5), containers-registries.conf(5), crio(8)

## HISTORY
Aug 2018, Update to the latest state by Valentin Rothberg ⟨vrothberg@suse.com⟩

Oct 2016, Originally compiled by Aleksa Sarai ⟨asarai@suse.de⟩


crio.conf.d

title: crio.conf.d(5)


crio.conf

title: crio.conf(5)

text:
# crio.conf(5)

## NAME
crio.conf - configuration file of the CRI-O OCI Kubernetes Container Runtime daemon

## DESCRIPTION
The CRI-O configuration file specifies all of the available configuration options and command-line flags for the crio(8) OCI Kubernetes Container Runtime daemon ⟨./crio.8.md⟩, but in a TOML format that can be more easily modified and versioned.

CRI-O supports partial configuration reload during runtime, which can be done by sending SIGHUP to the running process. Currently supported options in crio.conf are explicitly marked with 'This option supports live configuration reload'.

The containers-registries.conf(5) file can be reloaded as well by sending SIGHUP to the crio process.

The default crio.conf is located at /etc/crio/crio.conf.

## FORMAT
The TOML format ⟨https://github.com/toml-lang/toml⟩ is used as the encoding of the configuration file. Every option and subtable listed here is nested under a global "crio" table. No bare options are used. The format of TOML can be simplified to:

```
[table]
option = value
[table.subtable1]
option = value
[table.subtable2]
option = value
```

## CRIO TABLE
CRI-O reads its storage defaults from the containers-storage.conf(5) file located at /etc/containers/storage.conf. Modify this storage configuration if you want to change the system's defaults. If you want to modify storage just for CRI-O, you can change the storage configuration options here.

root="/var/lib/containers/storage"

Path to the "root directory". CRI-O stores all of its data, including containers images, in this directory.

runroot="/var/run/containers/storage"

Path to the "run directory". CRI-O stores all of its state in this directory.

storage_driver="overlay"

Storage driver used to manage the storage of images and containers. Please refer to containers-storage.conf(5) to see all available storage drivers.

storage_option=[]

List to pass options to the storage driver. Please refer to containers-storage.conf(5) to see all available storage options.

log_dir="/var/log/crio/pods"

The default log directory where all logs will go unless directly specified by the kubelet. The log directory specified must be an absolute directory.

version_file="/var/run/crio/version"

Location for CRI-O to lay down the temporary version file.

It is used to check if crio wipe should wipe containers, which should

always happen on a node reboot

version_file_persist=""

Location for CRI-O to lay down the persistent version file.

It is used to check if crio wipe should wipe images, which should

only happen when CRI-O has been upgraded

internal_wipe=true

This option is currently DEPRECATED, and will be removed in the future.

Whether CRI-O should wipe containers after a reboot and images after an upgrade when the server starts.

If set to false, one must run crio wipe to wipe the containers and images in these situations.

internal_repair=false

InternalRepair is whether CRI-O should check if the container and image storage was corrupted after a sudden restart.

If it was, CRI-O also attempts to repair the storage.

clean_shutdown_file="/var/lib/crio/clean.shutdown"

Location for CRI-O to lay down the clean shutdown file.

It is used to check whether crio had time to sync before shutting down.

If not found, crio wipe will clear the storage directory.

## CRIO.API TABLE
The crio.api table contains settings for the kubelet/gRPC interface.

listen="/var/run/crio/crio.sock"

Path to AF_LOCAL socket on which CRI-O will listen.

stream_address="127.0.0.1"

IP address on which the stream server will listen.

stream_port="0"

The port on which the stream server will listen. If the port is set to "0", then CRI-O will allocate a random free port number.

stream_enable_tls=false

Enable encrypted TLS transport of the stream server.

stream_idle_timeout=""

Length of time until open streams terminate due to lack of activity.

stream_tls_cert=""

Path to the x509 certificate file used to serve the encrypted stream. This file can change and CRI-O will automatically pick up the changes within 5 minutes.

stream_tls_key=""

Path to the key file used to serve the encrypted stream. This file can change and CRI-O will automatically pick up the changes within 5 minutes.

stream_tls_ca=""

Path to the x509 CA(s) file used to verify and authenticate client communication with the encrypted stream. This file can change and CRI-O will automatically pick up the changes within 5 minutes.

grpc_max_send_msg_size=83886080

Maximum grpc send message size in bytes. If not set or <=0, then CRI-O will default to 80 * 1024 * 1024.

grpc_max_recv_msg_size=83886080

Maximum grpc receive message size. If not set or <= 0, then CRI-O will default to 80 * 1024 * 1024.

## CRIO.RUNTIME TABLE
The crio.runtime table contains settings pertaining to the OCI runtime used and options for how to set up and manage the OCI runtime.

default_runtime="runc"

The name of the OCI runtime to be used as the default. This option supports live configuration reload.

default_ulimits=[]

A list of ulimits to be set in containers by default, specified as "<ulimit name>=<soft limit>:<hard limit>", for example:"nofile=1024:2048". If nothing is set here, settings will be inherited from the CRI-O daemon.

no_pivot=false

If true, the runtime will not use pivot_root, but instead use MS_MOVE.

decryption_keys_path="/etc/crio/keys/"

Path where the keys required for image decryption are located

conmon=""

Path to the conmon binary, used for monitoring the OCI runtime. Will be searched for using $PATH if empty.

This option is currently deprecated, and will be replaced with RuntimeHandler.MonitorPath.

conmon_cgroup=""

Cgroup setting for conmon

This option is currently deprecated, and will be replaced with RuntimeHandler.MonitorCgroup.

conmon_env=[]

Environment variable list for the conmon process, used for passing necessary environment variables to conmon or the runtime.

This option is currently deprecated, and will be replaced with RuntimeHandler.MonitorEnv.

default_env=[]

Additional environment variables to set for all the containers. These are overridden if set in the container image spec or in the container runtime configuration.

selinux=false

If true, SELinux will be used for pod separation on the host.

seccomp_profile=""

Path to the seccomp.json profile which is used as the default seccomp profile for the runtime. If not specified, then the internal default seccomp profile will be used.

This option is currently deprecated, and will be replaced by the SeccompDefault FeatureGate in Kubernetes.

seccomp_use_default_when_empty=true

Changes the meaning of an empty seccomp profile. By default (and according to CRI spec), an empty profile means unconfined.

This option tells CRI-O to treat an empty profile as the default profile, which might increase security.

apparmor_profile=""

Used to change the name of the default AppArmor profile of CRI-O. The default profile name is "crio-default".

blockio_config_file=""

Path to the blockio class configuration file for configuring the cgroup blockio controller.

cdi_spec_dirs=[]

Directories to scan for Container Device Interface Specifications to enable CDI device injection. For more details about CDI and the syntax of CDI Spec files please refer to ⟨https://github.com/container-orchestrated-devices/container-device-interface⟩.

Directories later in the list have precedence over earlier ones. The default directory list is:

```
  cdi_spec_dirs = [
	  "/etc/cdi",
	  "/var/run/cdi",

  ]
```

irqbalance_config_file="/etc/sysconfig/irqbalance"

Used to change irqbalance service config file which is used by CRI-O.

For CentOS/SUSE, this file is located at /etc/sysconfig/irqbalance. For Ubuntu, this file is located at /etc/default/irqbalance.

irqbalance_config_restore_file="/etc/sysconfig/orig_irq_banned_cpus"

Used to set the irqbalance banned cpu mask to restore at CRI-O startup. If set to 'disable', no restoration attempt will be done.

rdt_config_file=""

Path to the RDT configuration file for configuring the resctrl pseudo-filesystem.

cgroup_manager="systemd"

Cgroup management implementation used for the runtime.

default_capabilities=[]

List of default capabilities for containers. If it is empty or commented out, only the capabilities defined in the container json file by the user/kube will be added.

The default list is:

```
  default_capabilities = [
	  "CHOWN",
	  "DAC_OVERRIDE",
	  "FSETID",
	  "FOWNER",
	  "SETGID",
	  "SETUID",
	  "SETPCAP",
	  "NET_BIND_SERVICE",
	  "KILL",

  ]
```

add_inheritable_capabilities=false

Add capabilities to the inheritable set, as well as the default group of permitted, bounding and effective.

If capabilities are expected to work for non-root users, this option should be set.

default_sysctls=[]

List of default sysctls. If it is empty or commented out, only the sysctls defined in the container json file by the user/kube will be added.

One example would be allowing ping inside of containers. On systems that support /proc/sys/net/ipv4/ping_group_range, the default list could be:

```
  default_sysctls = [

       "net.ipv4.ping_group_range = 0   2147483647",

  ]
```

allowed_devices=[]

List of devices on the host that a user can specify with the "io.kubernetes.cri-o.Devices" allowed annotation.

additional_devices=[]

List of additional devices. Specified as "<device-on-host>:<device-on-container>:<permissions>", for example: "--additional-devices=/dev/sdc:/dev/xvdc:rwm". If it is empty or commented out, only the devices defined in the container json file by the user/kube will be added.

hooks_dir=["path", ...]

Each *.json file in the path configures a hook for CRI-O containers. For more details on the syntax of the JSON files and the semantics of hook injection, see oci-hooks(5). CRI-O currently support both the 1.0.0 and 0.1.0 hook schemas, although the 0.1.0 schema is deprecated.

Paths listed later in the array have higher precedence (oci-hooks(5) discusses directory precedence).

For the annotation conditions, CRI-O uses the Kubernetes annotations, which are a subset of the annotations passed to the OCI runtime. For example, io.kubernetes.cri-o.Volumes is part of the OCI runtime configuration annotations, but it is not part of the Kubernetes annotations being matched for hooks.

For the bind-mount conditions, only mounts explicitly requested by Kubernetes configuration are considered. Bind mounts that CRI-O inserts by default (e.g. /dev/shm) are not considered.

default_mounts=[]

List of default mounts for each container. Deprecated: this option will be removed in future versions in favor of default_mounts_file.

default_mounts_file=""

Path to the file specifying the defaults mounts for each container. The format of the config is /SRC:/DST, one mount per line. Notice that CRI-O reads its default mounts from the following two files:

```
1) `/etc/containers/mounts.conf` (i.e., default_mounts_file): This is the override file, where users can either add in their own default mounts, or override the default mounts shipped with the package.
2) `/usr/share/containers/mounts.conf`: This is the default file read for mounts. If you want CRI-O to read from a different, specific mounts file, you can change the default_mounts_file. Note, if this is done, CRI-O will only add mounts it finds in this file.
```

pids_limit=0

Maximum number of processes allowed in a container.

This option is deprecated. The Kubelet flag --pod-pids-limit should be used instead.

log_filter=""

Filter the log messages by the provided regular expression. This option supports live configuration reload. For example 'request:.*' filters all gRPC requests.

log_level="info"

Changes the verbosity of the logs based on the level it is set to. Options are fatal, panic, error, warn, info, debug, and trace. This option supports live configuration reload.

log_size_max=-1

Maximum size allowed for the container log file. Negative numbers indicate that no size limit is imposed. If it is positive, it must be >= 8192 to match/exceed conmon's read buffer. The file is truncated and re-opened so the limit is never exceeded.

This option is deprecated. The Kubelet flag --container-log-max-size should be used instead.

log_to_journald=false

Whether container output should be logged to journald in addition to the kubernetes log file.

container_exits_dir="/var/run/crio/exits"

Path to directory in which container exit files are written to by conmon.

container_attach_socket_dir="/var/run/crio"

Path to directory for container attach sockets.

bind_mount_prefix=""

A prefix to use for the source of the bind mounts. This option would be useful when running CRI-O in a container and the / directory on the host is mounted as /host in the container. Then if CRI-O runs with the --bind-mount-prefix=/host option, CRI-O would add the /host directory to any bind mounts it hands over to CRI. If Kubernetes asked to have /var/lib/foobar bind mounted into the container, then CRI-O would bind mount /host/var/lib/foobar. Since CRI-O itself is running in a container with / or the host mounted on /host, the container would end up with /var/lib/foobar from the host mounted in the container rather than /var/lib/foobar from the CRI-O container.

read_only=false

If set to true, all containers will run in read-only mode.

uid_mappings=""

The UID mappings for the user namespace of each container. A range is specified in the form containerUID:HostUID:Size. Multiple ranges must be separated by comma.

minimum_mappable_uid=-1

The lowest host UID which can be specified in mappings supplied, either as part of a uid_mappings or as part of a request received over CRI, for a pod that will be run as a UID other than 0.

gid_mappings=""

The GID mappings for the user namespace of each container. A range is specified in the form containerGID:HostGID:Size. Multiple ranges must be separated by comma.

minimum_mappable_gid=-1

The lowest host GID which can be specified in mappings supplied, either as part of a gid_mappings or as part of a request received over CRI, for a pod that will be run as a UID other than 0.

ctr_stop_timeout=30

The minimal amount of time in seconds to wait before issuing a timeout regarding the proper termination of the container.

drop_infra_ctr=true

Determines whether we drop the infra container when a pod does not have a private PID namespace, and does not use a kernel separating runtime (like kata).

Requires manage_ns_lifecycle to be true.

infra_ctr_cpuset=""

Determines the CPU set to run infra containers. If not specified, the CRI-O will use all online CPUs to run infra containers.

You can specify CPUs in the Linux CPU list format.

To get better isolation for guaranteed pods, set this parameter to be equal to kubelet reserved-cpus.

shared_cpuset=""

Determines the CPU set which is allowed to be shared between guaranteed containers,

regardless of, and in addition to, the exclusiveness of their CPUs.

This field is optional and would not be used if not specified.

You can specify CPUs in the Linux CPU list format.

namespaces_dir="/var/run"

The directory where the state of the managed namespaces gets tracked. Only used when manage_ns_lifecycle is true

pinns_path=""

The path to find the pinns binary, which is needed to manage namespace lifecycle

absent_mount_sources_to_reject=[]

A list of paths that, when absent from the host, will cause a container creation to fail (as opposed to the current behavior of creating a directory).

device_ownership_from_security_context=false

Changes the default behavior of setting container devices uid/gid from CRI's SecurityContext (RunAsUser/RunAsGroup) instead of taking host's uid/gid.

enable_criu_support=false

Enable CRIU integration, requires that the criu binary is available in $PATH. (default: false)

enable_pod_events=false Enable CRI-O to generate the container pod-level events in order to optimize the performance of the Pod Lifecycle Event Generator (PLEG) module in Kubelet.

hostnetwork_disable_selinux=true

Determines whether SELinux should be disabled within a pod when it is running in the host network namespace.

disable_hostport_mapping=false

Enable/Disable the container hostport mapping in CRI-O. Default value is set to 'false'.

### CRIO.RUNTIME.RUNTIMES TABLE
The "crio.runtime.runtimes" table defines a list of OCI compatible runtimes. The runtime to use is picked based on the runtime handler provided by the CRI. If no runtime handler is provided, the runtime will be picked based on the level of trust of the workload. This option supports live configuration reload. This option supports live configuration reload.

runtime_path=""

Path to the OCI compatible runtime used for this runtime handler.

runtime_root=""

Root directory used to store runtime data

runtime_type="oci"

Type of the runtime used for this runtime handler. "oci", "vm"

runtime_config_path=""

Path to the runtime configuration file, should only be used with VM runtime types

privileged_without_host_devices=false

Whether this runtime handler prevents host devices from being passed to privileged containers.

allowed_annotations=[]

This field is currently DEPRECATED. If you'd like to use allowed_annotations, please use a workload.

A list of experimental annotations this runtime handler is allowed to process.

The currently recognized values are:

"io.kubernetes.cri-o.userns-mode" for configuring a user namespace for the pod.

"io.kubernetes.cri-o.Devices" for configuring devices for the pod.

"io.kubernetes.cri-o.ShmSize" for configuring the size of /dev/shm.

"io.kubernetes.cri-o.UnifiedCgroup.$CTR_NAME" for configuring the cgroup v2 unified block for a container.

"io.containers.trace-syscall" for tracing syscalls via the OCI seccomp BPF hook.

platform_runtime_paths={}

A mapping of platforms to the corresponding runtime executable paths for the runtime handler.

### CRIO.RUNTIME.WORKLOADS TABLE
The "crio.runtime.workloads" table defines a list of workloads - a way to customize the behavior of a pod and container. A workload is chosen for a pod based on whether the workload's activation_annotation is an annotation on the pod.

activation_annotation=""

activation_annotation is the pod annotation that activates these workload settings.

annotation_prefix=""

annotation_prefix is the way a pod can override a specific resource for a container.

The full annotation must be of the form $annotation_prefix.$resource/$ctrname = $value.

allowed_annotations=[]

allowed_annotations is a slice of experimental annotations that this workload is allowed to process.

The currently recognized values are:

"io.kubernetes.cri-o.userns-mode" for configuring a user namespace for the pod.

"io.kubernetes.cri-o.Devices" for configuring devices for the pod.

"io.kubernetes.cri-o.ShmSize" for configuring the size of /dev/shm.

"io.kubernetes.cri-o.UnifiedCgroup.$CTR_NAME" for configuring the cgroup v2 unified block for a container.

"io.containers.trace-syscall" for tracing syscalls via the OCI seccomp BPF hook.

"io.kubernetes.cri-o.seccompNotifierAction" for enabling the seccomp notifier feature.

"io.kubernetes.cri-o.umask" for setting the umask for container init process.

### Using the seccomp notifier feature:
This feature can help you to debug seccomp related issues, for example if blocked syscalls (permission denied errors) have negative impact on the workload.

To be able to use this feature, configure a runtime which has the annotation "io.kubernetes.cri-o.seccompNotifierAction" in the allowed_annotations array.

It also requires at least runc 1.1.0 or crun 0.19 which support the notifier feature.

If everything is setup, CRI-O will modify chosen seccomp profiles for containers if the annotation "io.kubernetes.cri-o.seccompNotifierAction" is set on the Pod sandbox. CRI-O will then get notified if a container is using a blocked syscall and then terminate the workload after a timeout of 5 seconds if the value of "io.kubernetes.cri-o.seccompNotifierAction=stop".

This also means that multiple syscalls can be captured during that period, while the timeout will get reset once a new syscall has been discovered.

This also means that the Pods "restartPolicy" has to be set to "Never", otherwise the kubelet will restart the container immediately.

Please be aware that CRI-O is not able to get notified if a syscall gets blocked based on the seccomp defaultAction, which is a general runtime limitation.

### CRIO.RUNTIME.WORKLOAD.RESOURCES TABLE
The resources table is a structure for overriding certain resources for pods using this workload. This structure provides a default value, and can be overridden by using the AnnotationPrefix.

cpushares="" Specifies the number of CPU shares this pod has access to.

cpuset="" Specifies the cpuset this pod has access to.

## CRIO.IMAGE TABLE
The crio.image table contains settings pertaining to the management of OCI images.

CRI-O reads its configured registries defaults from the system wide containers-registries.conf(5) located in /etc/containers/registries.conf. If you want to modify just CRI-O, you can change the registries configuration in this file. Otherwise, leave insecure_registries and registries commented out to use the system's defaults from /etc/containers/registries.conf.

default_transport="docker://"

Default transport for pulling images from a remote container storage.

global_auth_file=""

The path to a file like /var/lib/kubelet/config.json holding credentials necessary for pulling images from secure registries.

pause_image="registry.k8s.io/pause:3.9"

The image used to instantiate infra containers. This option supports live configuration reload.

pause_image_auth_file=""

The path to a file like /var/lib/kubelet/config.json holding credentials specific to pulling the pause_image from above. This option supports live configuration reload.

pause_command="/pause"

The command to run to have a container stay in the paused state. This option supports live configuration reload.

pinned_images=[]

A list of images to be excluded from the kubelet's garbage collection. It allows specifying image names using either exact, glob, or keyword patterns. Exact matches must match the entire name, glob matches can have a wildcard * at the end, and keyword matches can have wildcards on both ends. By default, this list includes the pause image if configured by the user, which is used as a placeholder in Kubernetes pods.

signature_policy=""

Path to the file which decides what sort of policy we use when deciding whether or not to trust an image that we've pulled. It is not recommended that this option be used, as the default behavior of using the system-wide default policy (i.e., /etc/containers/policy.json) is most often preferred. Please refer to containers-policy.json(5) for more details.

signature_policy_dir="/etc/crio/policies"

Root path for pod namespace-separated signature policies. The final policy to be used on image pull will be <SIGNATURE_POLICY_DIR>/<NAMESPACE>.json. If no pod namespace is being provided on image pull (via the sandbox config), or the concatenated path is non existent, then the signature_policy or system wide policy will be used as fallback. Must be an absolute path.

image_volumes="mkdir"

Controls how image volumes are handled. The valid values are mkdir, bind and ignore; the latter will ignore volumes entirely.

insecure_registries=[]

List of registries to skip TLS verification for pulling images.

registries=["docker.io"]

List of registries to be used when pulling an unqualified image. Note support for this option has been dropped and it has no effect. Please refer to containers-registries.conf(5) for configuring unqualified-search registries.

big_files_temporary_dir=""

Path to the temporary directory to use for storing big files, used to store image blobs and data streams related to containers image management.

separate_pull_cgroup=""

[EXPERIMENTAL] If its value is set, then images are pulled into the specified cgroup. If its value is set to "pod", then the pod's cgroup is used. It is currently supported only with the systemd cgroup manager.

## CRIO.NETWORK TABLE
The crio.network table containers settings pertaining to the management of CNI plugins.

cni_default_network=""

The default CNI network name to be selected. If not set or "", then CRI-O will pick-up the first one found in network_dir.

network_dir="/etc/cni/net.d/"

Path to the directory where CNI configuration files are located.

plugin_dirs=["/opt/cni/bin/",]

List of paths to directories where CNI plugin binaries are located.

## CRIO.METRICS TABLE
The crio.metrics table containers settings pertaining to the Prometheus based metrics retrieval.

enable_metrics=false

Globally enable or disable metrics support.

metrics_collectors=["operations", "operations_latency_microseconds_total", "operations_latency_microseconds", "operations_errors", "image_pulls_by_digest", "image_pulls_by_name", "image_pulls_by_name_skipped", "image_pulls_failures", "image_pulls_successes", "image_pulls_layer_size", "image_layer_reuse", "containers_events_dropped_total", "containers_oom_total", "containers_oom", "processes_defunct"]

Enabled metrics collectors

metrics_host=""

The host on which the metrics server will listen.

metrics_port=9090

The port on which the metrics server will listen.

metrics_socket=""

The socket on which the metrics server will listen.

metrics_cert=""

The certificate for the secure metrics server.

metrics_key=""

The certificate key for the secure metrics server.

## CRIO.TRACING TABLE
[EXPERIMENTAL] The crio.tracing table containers settings pertaining to the export of OpenTelemetry trace data.

enable_tracing=false

Globally enable or disable OpenTelemetry trace data exporting.

tracing_endpoint="0.0.0.0:4317"

Address on which the gRPC trace collector will listen.

tracing_sampling_rate_per_million=""

Number of samples to collect per million OpenTelemetry spans. Set to 1000000 to always sample.

## CRIO.STATS TABLE
The crio.stats table specifies all necessary configuration for reporting container and pod stats.

stats_collection_period=0

The number of seconds between collecting pod and container stats. If set to 0, the stats are collected on-demand instead.

## CRIO.NRI TABLE
The crio.nri table contains settings for controlling NRI (Node Resource Interface) support in CRI-O. enable_nri=false

Enable CRI-O NRI support.

nri_plugin_dir="/opt/nri/plugins"

Directory to scan for pre-installed plugins to automatically start.

nri_plugin_config_dir="/etc/nri/conf.d"

Directory to scan for configuration of pre-installed plugins.

nri_listen="/var/run/nri/nri.sock"

Socket to listen on for externally started NRI plugins to connect to.

nri_disable_connections=false

Disable connections from externally started NRI plugins.

nri_plugin_registration_timeout="5s"

Timeout for a plugin to register itself with NRI.

nri_plugin_request_timeout="2s"

Timeout for a plugin to handle an NRI request.

## SEE ALSO
crio.conf.d(5), containers-storage.conf(5), containers-policy.json(5), containers-registries.conf(5), crio(8)

## HISTORY
Aug 2018, Update to the latest state by Valentin Rothberg ⟨vrothberg@suse.com⟩

Oct 2016, Originally compiled by Aleksa Sarai ⟨asarai@suse.de⟩


crio.conf.d

title: crio.conf.d(5)


cmtab

package: cryptmount

title: cmtab(5)

text:
# cmtab(5)

## NAME
cmtab - static information about filesystems managed by cryptmount

## DESCRIPTION
Information about the encrypted filesystems managed by cryptmount is contained in the file /etc/cryptmount/cmtab. Each filesystem is labelled by a target name which can be used as an argument to cryptmount and which appears in /etc/cryptmount/cmtab in front of a list of parameters describing where that filesystem is stored, and how it is encrypted.

The format of the cmtab is flexible, with the description of each target being delimited by braces, parameters being specified by KEY=VALUE pairs, and white-space being freely usable. Comments are prefixed by a `#' character, and can start at any point in a line, lasting to the end of the line. The backslash character `\' can be used to ignore any special significance of the following character, for example to include a space in a filename.

/etc/cryptmount/cmtab contains entries of the following form:

```
    TARGET_NAME {

        dev=DEVICE                      # REQUIRED

        flags=FLAG,FLAG,...

        startsector=STARTSECTOR

        numsectors=NUMSECTORS

        loop=LOOPDEV

        dir=MOUNT_POINT

        fstype=TYPE                     # REQUIRED

        mountoptions=MOPT,MOPT,...

        fsckoptions=FOPT;FOPT;...

        supath=SUPATH

        bootaction=BOOTACTION

        cipher=CIPHER

        ivoffset=IVOFFSET

        keyformat=KEYMANAGER

        keyfile=KEYFILE                 # REQUIRED

        keyhash=KEYHASH

        keycipher=KEYCIPHER

        keymaxlen=KEYMAXLEN

        passwdretries=NUMATTEMPTS

    }
```

Some fields, such as `dev' and `fstype' are mandatory, although many fields have sensible default values. Depending on the choice of KEYMANAGER, fields such as `keyhash', `keycipher', `keymaxlen' may need to be set explicitly.

Any field which contains non-numerical values (e.g. not `startsector', `ivoffset' etc.) can contain references to environmental variables of the form $(HOME). The following variables are recognized, all based on the characteristics of the user currently running cryptmount :

```
  * $(HOME) - the home directory, as obtained from /etc/passwd

  * $(UID) - the numerical identifier of the user

  * $(USERNAME) - the printable name of the user

  * $(GID) - the numerical identifier of the user's current group

  * $(GROUPNAME) - the printable name of the user's current group
```

## TARGET DEFINITIONS
The components in each target definition have the following meaning:

TARGET_NAME { ... }

specifies the name that cryptmount uses to refer to a particular filesystem, with configuration options for that filesystem contained within the matching braces. The special name "_DEFAULTS_" may be used to set default values in subsequent targets for various parameters such as 'flags', 'fstype', 'mountoptions', 'cipher', 'keyformat', 'keyhash', 'keycipher', 'keymaxlen', 'passwdretries'. Note that if the "_DEFAULTS_" target appears more than once, each will undo the effects of previous default values - i.e. this pseudo-target does not operate incrementally.

dev=DEVICE

sets the name of the raw device (e.g. /dev/hdb63) or ordinary file (e.g. /home/secretiveuser/private.fs) that contains the encrypted filesystem. Note that it may be useful to use a symbolic name based on an entry beneath /dev/disk/by-id, /dev/disk/by-path, to reduce the risk of device nodes being renamed when new disks are added to the system, etc.

flags=FLAG,FLAG,...

sets configuration switches, such as

```
  * "user" (any user can mount),

  * "nouser" (only root can mount),

  * "fsck" (automatically check filesystem before mounting),

  * "nofsck" (don't check filesystem before mounting),

  * "mkswap" (format swap partition before use),

  * "nomkswap" (don't format swap partition)

  * "trim" (enable TRIM/discard support on solid-state disks),

  * "notrim" (disable SSD TRIM/discard support)
```

This parameter is optional and defaults to "user,fsck,nomkswap,notrim".

startsector=STARTSECTOR

gives the number of sectors (512-byte blocks) into DEVICE at which the filesystem is to start. This parameter is optional, and defaults to zero.

numsectors=NUMSECTORS

gives the total length of the filesystem in sectors (512-byte blocks). This parameter is optional, and defaults to -1 which is shorthand for the total available length of DEVICE.

loop=LOOPDEV

can be used to specify a particular loopback device (e.g. /dev/loop0) to be used when DEVICE is an ordinary file. This parameter is optional and defaults to "auto".

dir=MOUNT_POINT

specifies the directory onto which the encrypted filesystem will be mounted.

fstype=TYPE

sets the filesystem type (as used by mount (8)). This must be set to "swap" if the device is to be used as an encrypted swap partition.

mountoptions=MOPT,MOPT,...

sets filesystem mounting options, as used by mount (8). MOPT can typically be "default", "noatime", "noexec", "nosuid", "ro", "sync" etc.

fsckoptions=FOPT;FOPT;...

sets filesystem-checking options understood by fsck (8). FOPT can typically be "-C", "-V" etc. Note that the list of fsck options uses semicolons as a separator to allow passing options that themselves contain commas.

supath=SUPATH

sets the PATH environment variable when running subprocesses as the super-user. This may be necessary when commands such as fsck and mount need to run subcommands (e.g. fsck.ext4). By default, this PATH is set to /sbin:/bin:/usr/sbin:/usr/bin.

bootaction=BOOTACTION

indicates what action, if any, should be taken for this target on system bootup. BOOTACTION can be one of "none", "mount", "swap" or "prepare".

cipher=CIPHER

sets the encryption algorithm used on the DEVICE. The available algorithms are determined by the system kernel. This parameter is optional and defaults to "aes-cbc-plain".

keyformat=KEYMANAGER

specifies the key management scheme used to interact with the KEYFILE, as discussed in the CHOICE OF KEYMANAGER section below. The set of available key management schemes is determined when cryptmount is built, but may include "libgcrypt", "luks", and "openssl-compat", in addition to "builtin" and "raw". This parameter is optional: if absent, "builtin" will be used on first generating the key, with an automatic choice being made when reading a pre-existing key.

keyfile=KEYFILE

gives the name of an ordinary file that contains the key used by the CIPHER algorithm to decrypt the filesystem. This key is itself encrypted in a way specified by the KEYHASH and KEYCIPHER

ivoffset=IVOFFSET

sets the offset added to the sector-number used in constructing the cipher algorithm's initialization vector. This parameter is optional, and defaults to 0.

keyhash=KEYHASH

is the hashing algorithm used to turn the user's password into the decryption key used by the KEYCIPHER algorithm. The available hashing algorithms are determined by the chosen key-encryption engine specified by KEYMANAGER. This parameter is optional and the default depends on the value of KEYMANAGER.

keycipher=KEYCIPHER

is the encryption algorithm used to secure the decryption key of the filesystem itself. The available key-encryption algorithms are determined by the chosen key-encryption engine specified by KEYMANAGER. This parameter is optional and the default depends on the value of KEYMANAGER.

keymaxlen=KEYMAXLEN

is the maximum number of bytes of the decryption key that will be read from KEYFILE. This parameter is optional, and defaults to 0, indicating that the full length of KEYFILE should be read.

passwdretries=NUMATTEMPTS

is the number of password-entry attempts that can be made before cryptmount will exit with an error-code when trying to mount or configure the target.

## CHOICE OF KEYMANAGER
cryptmount supports a variety of different ways of protecting the access key associated with each encrypted filesystem. For most users, the default “builtin” keymanager will provide a good level of security and flexibility. Alternative keymanagers offer a wider choice of different password-hashing schemes and compatibility with other encryption tools. The strengths and weaknesses of the different keymanagers are discussed below.

builtin

This keymanager is supported by cryptmount-2.0 or later, and uses a separate key-file. A password-based key derivation function (PBKDF) using the SHA1 hashing algorithm, together with blowfish-cbc encryption is used to protect the filesystem key. That key-derivation function was changed in cryptmount-4.0 to improve the security of new keyfiles, while preserving compatibility with existing keyfiles. If you need to write keyfiles in the previous format, you can specify “keyformat=builtin:0”. The KEYHASH and KEYCIPHER parameters are ignored.

libgcrypt

This keymanager is supported by cryptmount-1.1 or later, and uses a separate key-file. A password-based key derivation function (PBKDF) is used to protect the filesystem key, with any hashing or cipher algorithm supported by the installed version of the libgcrypt library being available.

luks

This keymanager is supported by cryptmount-3.1 or later, and provided compatibility with the Linux Unified Key Setup (LUKS) disk-format. Instead of a separate keyfile, LUKS uses a header within the encrypted filesystem itself. It is advisable to choose the same value for both the 'dev' and 'keyfile' parameters, or leave 'keyfile' unspecified. As with all cryptmount filesystems, the 'dev' parameter may point to either a raw disk partition or an ordinary file. However, because of the filesystem structure assumed by LUKS, it is strongly recommended that you do not use either the 'startsector' or 'numsector' parameters.

openssl/openssl-compat

This keymanager has been supported since the earliest release of cryptmount, and uses a separate keyfile which is compatible with the format used by the 'openssl' command-line encryption tool. Since cryptmount-3.0 this file-format has been provided via the libgcrypt library, and is preferably specified by “keyformat=openssl-compat”. A password-based key derivation function (PBKDF) is used to protect the filesystem key, with a choice of hashing or cipher algorithms being available. Most algorithms supported by the 'openssl' command-line tool should be available, provided the underlying algorithms are available within libgcrypt.

password

This keymanager is supported by cryptmount-4.0 or later, and does not require any separate keyfile, but instead derives the filesystem key directly from the user's password. This means that it is not possible to change the access password without re-encrypting the entire filesystem. The 'keyhash' and 'keycipher' parameters are ignored.

raw

This keymanager is supported by cryptmount-1.1 or later, and uses a separate keyfile where the access key is stored directly and without any encryption. This keymanager is most useful for managing encrypted swap partitions, where the keyfile can be chosen as /dev/random, and hence where the access key will be different every time it is read. If the keyfile is an ordinary file, it offers minimal security, and should preferably be stored separately from the disk containing the encrypted filesystem, e.g. on a USB flash disk.

## SECURITY
Because cryptmount needs to operate with setuid privileges, it is very important that its configuration file is kept secure. Ideally /etc/cryptmount/cmtab should be managed only by the system administrator, and all key-files should be readable only by their owner.

cryptmount makes basic checks on the security of /etc/cryptmount/cmtab each time it runs, and will refuse to operate unless the following conditions are met:

```
  * cmtab must be owned by root

  * cmtab must be a regular file

  * cmtab must not be globally writable

  * the directory containing cmtab must be owned by root

  * the directory containing cmtab must not be globally writable
```

In addition, for each target within @CM_SYSCONFDIR@/cmtab, all paths must be absolute (i.e. starting with '/'). When using unencrypted keyfiles (i.e. when KEYMANAGER is "raw"), it is recommended that the KEYFILE is stored with access permissions no less restrictive than 0600, or on a removable device such as a USB flash-disk. (With recent versions of cryptmount the "builtin" key-format should be portable between different installations and vastly more secure than "raw" keyfiles.)

It is very important that you do not lose or damage the KEYFILE as this file is essential to providing access to your encrypted filesystem. You are strongly advised to consider keeping a backup of your KEYFILE in some form.

## ENCRYPTED SWAP PARTITIONS & AUTO-FORMATTING
When the 'mkswap' option is selected for a particular target within @CM_SYSCONFDIR@/cmtab, cryptmount will attempt to automatically format an encrypted swap partition whenever you run "cryptmount --swapon <target>". This is often useful when there is no need to preserve swap data between reboots, such as when not using the kernel's hibernation features.

Because reformatting will destroy any existing data on the chosen swap partition, cryptmount will do some basic checking on the first megabyte of the partition, based on the degree of randomness (entropy) in the current contents. If the partition looks like it contains pure noise, or has been zeroed, then the partition will be formatted automatically. If cryptmount determines that the partition may contain non-random data, then it will ask you to run 'mkswap' manually.

As there is no fool-proof way of determining whether a partition (especially after encryption) contains valuable data, you should be very careful about the raw device chosen for any target on which you select the 'mkswap' option.

## EXAMPLE FILE
The following example of @CM_SYSCONFDIR@/cmtab consists of five targets, using a variety of encryption algorithms and storing their filesystems in different ways, including a target representing an encrypted swap partition:

```
    # @CM_SYSCONFDIR@/cmtab

    # example file - please modify before use

    _DEFAULTS_ {

        passwdretries=3     # allow 3 password attempts by default

    }

    basic {

        dev=/home/secretiveuser/crypt.fs

        dir=/home/secretiveuser/crypt           # where to mount

        loop=auto                               # find free loop-device

        fstype=ext3     mountoptions=default

        cipher=aes-cbc-plain                    # filesystem encryption

        keyfile=/home/secretiveuser/crypt.key

        # use default sha1/blowfish key-encryption:

        keyformat=builtin

    }

    partition {

        dev=/dev/hdb62                      # use whole disk partition

        dir=/mnt/crypt62

        fstype=ext3     mountoptions=nosuid,noexec

        cipher=serpent-cbc-plain

        # information about file used to store decryption key:

        keyfile=@CM_SYSCONFDIR@/crypt_hdb62.key

        keyformat=openssl                   # use OpenSSL key-encryption

        keyhash=md5 keycipher=bf-cbc        # encryption of key file

    }

    subset {

        dev=/dev/hdb63

        startsector=512 numsectors=16384    # use subset of partition

        dir=/mnt/encrypted\ subset\ of\ hdb

        fstype=reiserfs     mountoptions=defaults

        cipher=twofish-cbc-plain            # filesystem encryption

        # information about file used to store decryption key:

        keyfile=@CM_SYSCONFDIR@/crypt_hdb63.key

        keyformat=libgcrypt

        keyhash=md5 keycipher=blowfish-cbc # encryption of key file

    }

    encswap {                               # encrypted swap partition

        bootaction=swap

        dev=/dev/disk/by-id/scsi-SATA_ST500_ABCDEFG-part37

        startsector=16896 numsectors=1024   # use subset of partition

        fstype=swap        flags=mkswap       cipher=twofish-cbc-plain

        # read fresh 16-byte key from /dev/random whenever used:

        keyfile=/dev/random        keymaxlen=16     keyformat=raw

    }

    luks {                          # partition created by cryptsetup-luks

        dev=/dev/hdb63

        dir=/mnt/luks-partition-$(USERNAME)

        keyformat=luks

        keyfile=/dev/hdb63

        fstype=ext3

    }

    # end of cmtab
```

The 'basic' target uses an ordinary file "/home/secretiveuser/crypt.fs" to store the encrypted filesystem, perhaps within a normal user's home directory. A loopback device will be automatically allocated (because of the "loop=auto") by cryptmount to turn this into a block-special device, before mounting. The decryption key for the filesystem is also stored in this user's home directory, making it easier for them to change the password protecting the key.

The 'partition' target uses a whole disk partition to store the encrypted filesystem, with the decryption key stored in the main cryptmount configuration directory.

The 'subset' target is similar to the 'partition' target except that it does not use a whole disk partition. This would allow other groups of blocks within that partition to be used for other filesystems managed via cryptmount or dmsetup.

The 'encswap' target uses a subset of blocks within a disk partition to form an encrypted swap device. A new encryption key is read from the system random-number generator /dev/random every time the target is used.

The 'luks' target provides access to an encrypted partition created by the 'cryptsetup-luks' utility. By using the environmental variable $(USERNAME), the filesystem's mount-point will vary depending on which user invokes cryptmount. For example, user 'joe' would find the filesystem mounted below /mnt/luks-partition-joe. cryptmount will be able to mount and unmount the partition, but various advanced LUKS features must be accessed through cryptsetup

## FILES
/etc/cryptmount/cmtab - main configuration file

## SEE ALSO
cryptmount(8), cryptmount-setup(8), cryptsetup(8), dmsetup(8), openssl(1)

## COPYRIGHT NOTICE
cryptmount is Copyright 2005-2019 RW Penney

and is supplied with NO WARRANTY. Licencing terms are as described in the file "COPYING" within the cryptmount source distribution.


classes.conf

package: cups

title: classes.conf(5)

summary: class configuration file for cups

text:
# classes.conf(5)

## NAME
classes.conf - class configuration file for cups

## DESCRIPTION
The classes.conf file defines the local printer classes that are available. It is normally located in the /etc/cups directory and is maintained by the cupsd(8) program. This file is not intended to be edited or managed manually.

## NOTES
The name, location, and format of this file are an implementation detail that will change in future releases of CUPS.

## SEE ALSO
cupsd(8), cupsd.conf(5), mime.convs(5), mime.types(5), printers.conf(5), subscriptions.conf(5), CUPS Online Help (http://localhost:631/help)

## COPYRIGHT
Copyright © 2020-2024 by OpenPrinting.